|
c7697595d8
|
fix(browser): report attached locale coverage limits
Fixes #3395.
Disclose attached locale coverage in complete and retained partial captures,
clarify the shared locale contract, and verify actual CLI/MCP caller-language
preservation and browser cleanup. Launch supplies full page/request locale.
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
|
2026-10-15 19:37:19 +08:00 |
|
|
morluto
|
eca18e08ac
|
fix(verifiers): require positive ownership and restore cleanup coverage
|
2026-10-14 09:47:57 +08:00 |
|
|
morluto
|
cfce91d418
|
fix(browser): serialize attached scenarios through cleanup settlement
|
2026-10-10 01:45:01 +08:00 |
|
|
dakjdakd
|
a0523b375e
|
fix(browser): retain attached scenario emulation until cleanup
|
2026-10-10 01:45:00 +08:00 |
|
|
morluto
|
614e0c2e74
|
fix(browser): retain scenario observations across failures
|
2026-10-09 22:46:08 +08:00 |
|
|
morluto
|
96af2fa744
|
fix(browser): preserve captures when response bodies are unavailable
|
2026-10-09 07:47:34 +08:00 |
|
|
morluto
|
0a0174b9ac
|
fix(browser): validate and bound source-map evidence
|
2026-10-09 06:32:10 +08:00 |
|
|
N0zoM1z0
|
6dd719eaf6
|
fix(browser): preserve form destinations and satisfies mutation uncertainty (#825)
Resolve empty form destinations from the captured document URL while preserving
base-relative links and Chrome's form/control whitespace distinction. Follow
satisfies wrappers when propagating explicit member mutation paths.
Add fail-before regressions and real-browser CLI/MCP verification.
Fixes #820
Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
|
2026-10-07 11:22:03 +08:00 |
|
|
|
3af3811ab0
|
fix: integrate 24 reviewed browser/native/semantics corrections (#815)
* fix(reference): resolve emitted extensions to TypeScript source
Signed-off-by: Rudy Celekli <rudy@gradiahq.com>
* test(reference): retain legitimate declaration import counterparts
Signed-off-by: Rudy Celekli <rudy@gradiahq.com>
* fix(mcp): recognize implicit form elicitation capability
Signed-off-by: RudyCelekli <47457359+rudycelekli@users.noreply.github.com>
* fix(ghidra): reject contradictory NativeAOT reports
* fix(native): preserve thin architectures across echoed filename lines
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>
* fix(native): preserve app bundle executable filename whitespace
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>
* fix(doctor): validate Node-wrapped client policy
Signed-off-by: RudyCelekli <47457359+rudycelekli@users.noreply.github.com>
* fix(reference): preserve observed entry failure reasons
Signed-off-by: Rudy Celekli <rudy@gradiahq.com>
* fix(artifacts): verify opaque bytes before reusing inventory identities
Signed-off-by: Rudy Celekli <rudy@gradiahq.com>
* fix(browser): resolve DOM destinations against document base URL
Signed-off-by: Rudy Celekli <rudy@gradiahq.com>
* fix: recover serialized native NIB view hierarchy
Signed-off-by: RudyCelekli <47457359+rudycelekli@users.noreply.github.com>
* ci: exercise native compiled NIB hierarchy regressions
Signed-off-by: RudyCelekli <47457359+rudycelekli@users.noreply.github.com>
* fix(deps): remediate reachable archive-parsing advisories
Two high-severity advisories are reachable from untrusted target content:
- @xmldom/xmldom 0.9.10 (via plist) parses XML plist bytes from analyzed
app bundles in the keyed-archive reader. Refreshed to 0.9.12.
- brace-expansion 5.0.7 (via @electron/asar -> minimatch) is reached while
analyzing untrusted ASAR archives. Refreshed to 5.0.12.
Both are in-range patch updates (plist declares ^0.9.10, minimatch declares
^5.0.5), so no source or API change is required and no direct dependency
declaration moves. Lockfile-only change.
The remaining smol-toml advisory is not included: it parses operator-owned
client configuration rather than untrusted target content, and its fix moves
outside the declared range and changes leading-BOM handling.
* fix(semantics): link wrapped arrow Promise returns
* fix(reconstruction): preserve unknown graph limitations
* fix(native): preserve exact code signing identifiers
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>
* fix(native): recognize only whole otool command headers
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>
* fix(native): retain nm-proven literal export names
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>
* fix(javascript): project decoded file URL paths
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>
* fix: preserve explicit source-relative URL observation spelling
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>
* fix(native): project Mach-O evidence into container file offsets
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>
* fix(browser): normalize referrer policy fallback lists
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>
---------
Signed-off-by: Rudy Celekli <rudy@gradiahq.com>
Signed-off-by: RudyCelekli <47457359+rudycelekli@users.noreply.github.com>
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>
Co-authored-by: Rudy Celekli <rudy@gradiahq.com>
Co-authored-by: RudyCelekli <47457359+rudycelekli@users.noreply.github.com>
Co-authored-by: Kaoru0822 <aisakamimaki@gmail.com>
Co-authored-by: DeryFerd <deryferdikao125@gmail.com>
|
2026-10-07 10:33:10 +08:00 |
|
|
Rudy Mizrahi Celekli
|
78014e3d14
|
fix(browser): fingerprint cookies at the selected page URL (#763)
Signed-off-by: Rudy Celekli <rudy@gradiahq.com>
|
2026-10-07 10:11:57 +08:00 |
|
|
morluto
|
b5e98915c6
|
fix(tools)!: simplify direct invocation and harden boundary contracts (#555)
Remove REA permission grants, scope ceilings, approval confirmations, and inert settings. Preserve selected local evidence, accept caller-chosen commands and paths, and report actual runtime failures.
Harden provider results, schema serialization, snapshot evidence binding, archive paths, source maps, native screenshots, managed EH parsing, and cancellation cleanup. Regenerate tool metadata and document direct invocation.
BREAKING CHANGE: Removed permission configuration and policy commands, approval fields, filesystem scope inputs, and fixed confirmation options. Process capture inherits the host environment and accepts command names; callers must refresh tool schemas and migrate removed fields.
|
2026-10-05 20:16:44 +08:00 |
|
|
morluto
|
4fbc501121
|
feat(native): add inspection primitives, dispatch traces and approved UI observation (#500)
* fix(hopper): normalize string-backed addresses and update verification
* feat(native): add inspection primitives, dispatch traces and approved UI observation
* test: prioritize real artifact E2E and captured golden regressions
* fix(process): queue observed output before reactive rendering actions
* test: prune redundant cases and strengthen boundary assertions
* fix(cli): route native value tracing through shared workflows
* test: replace synthetic success with real workflows and captured data
* fix(catalog): separate portable metadata from native host availability
|
2026-10-04 16:02:36 +08:00 |
|
|
N0zoM1z0
|
be76f8090b
|
feat: add web and Electron reverse-engineering workflows
|
2026-07-14 20:24:12 +09:00 |
|